Splunk Search

stats values

vumanhtai
Path Finder

Hi Splunk Team!
i have a query: index=mail sourcetype=webmail | stats values(time) as time values(severity) as severity values(email) as email values(status) by session_ID
Results as shown in a picture
i want to show result of values (severity) greater than 2 values?
how can i do it?
Thanks!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vumanhtai,
let me understand, do you want to have session_IDs where:

  • there's a severity value greater than 2,
  • there are more than 2 different severity values?

In the first case, try this:

index=mail sourcetype=webmail 
| stats values(time) as time maxs(severity) as severity values(email) as email values(status) by session_ID
| where severity>2

In the second case, try this:

index=mail sourcetype=webmail 
| stats values(time) as time values(severity) as severity dc(severity) as dc_severity values(email) as email values(status) by session_ID
| where dc_severity>2

Ciao.
Giuseppe

0 Karma

vumanhtai
Path Finder

thank you
kamlesh_vaghela's answer helped me solve this problem

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@vumanhtai

Are you looking for this?

YOUR_SEARCH | where mvcount(severity) > 2
0 Karma

vumanhtai
Path Finder

Thank you so much!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@vumanhtai

Glad to help you. Please accept this answer to close this question.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...